MacBook Sleep & Network Activity

TL;DR

Yes, a closed (sleeping) MacBook can send network data. This is normal behaviour for features like Time Machine backups, iCloud sync, Handoff, and software updates. You can check what’s happening using Activity Monitor or the command line.

How to Check Network Activity While Sleeping

1. Understand Sleep States: Macs don’t truly ‘turn off’ when you close the lid. They enter different sleep states, some of which allow network access.
   • Sleep: Most processes are paused, but some background tasks can still run.
   • Safe Sleep: The contents of RAM are saved to your hard drive, allowing a faster wake-up. Network activity is limited.
2. Using Activity Monitor: This provides a graphical view.
   1. Open Activity Monitor (Applications > Utilities).
   2. Click the Network tab.
   3. Sort by ‘Sent Bytes’ or ‘Received Bytes’. Even with the lid closed, you may see some activity from processes like mds (Spotlight), bird (iCloud sync), or backupd (Time Machine).
3. Using Terminal: This gives more detailed information.
   1. Open Terminal (Applications > Utilities).
   2. Use the netstat command to see active network connections.

      netstat -an | grep ESTABLISHED

      This shows established connections.

   3. Use tcpdump to capture and analyse network packets (requires sudo). This is more advanced.

      sudo tcpdump -i en0 -n -s 0 -w macbook_network.pcap

      (Replace en0 with your active network interface – use ifconfig to find it.)

4. Identify Common Processes: Here’s what some processes mean:
   • mds (Spotlight): Indexes files, may sync with iCloud.
   • bird (iCloud Sync): Keeps your data synced across devices.
   • backupd (Time Machine): Performs backups to a Time Machine drive.
   • softwareupdate: Checks for and downloads updates.

Stopping Network Activity During Sleep

You can’t completely disable all network activity, but you can reduce it:

1. Disable iCloud Sync: In System Settings > Apple ID > iCloud, turn off services you don’t need while sleeping.
2. Schedule Time Machine Backups: Configure backups to run only when the MacBook is plugged in and awake. (System Settings > General > Time Machine).
3. Disable Automatic Updates: System Settings > General > Software Update > Uncheck ‘Automatically keep my Mac up to date’.
4. Disconnect from Wi-Fi: The simplest way, but obviously means no network access at all.

Important Considerations

• Some background tasks are essential for the smooth operation of your MacBook. Disabling them entirely may cause problems.
• Regular software updates are important for cyber security and stability.